CVE-2026-111063
Received Received - Intake

Secure Cookie Attribute Bypass in AIOHTTP

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111063
EUVD
EUVD-2026-104478

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aio-libs aiohttp < 3.14.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-311 The product does not encrypt sensitive or critical information before storage or transmission.
CWE-1004 The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the aiohttp library before version 3.14.4. It involves the Secure attribute for shared cookies not being enforced, allowing a cookie marked as Secure to be sent with an unencrypted request. This could expose sensitive data during transmission.

Detection Guidance

Check the installed version of aiohttp using pip show aiohttp. If the version is below 3.14.4, the system is vulnerable. Inspect application code for shared cookies marked Secure and verify they are only sent over HTTPS connections.

Impact Analysis

An attacker could intercept unencrypted requests containing sensitive cookie data, potentially gaining access to session tokens or other confidential information. This risk is higher in environments where HTTP traffic is not protected by encryption.

Compliance Impact

This vulnerability may violate requirements for protecting sensitive data in transit, such as GDPR's encryption mandates or HIPAA's safeguards for electronic protected health information. Non-compliance could result in legal or regulatory penalties.

Mitigation Strategies

Upgrade aiohttp to version 3.14.4 or later using pip install --upgrade aiohttp. Review and update cookie handling logic to ensure Secure cookies are only transmitted over encrypted connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart